creator/Anthropic-Cybersecurity-Skills
1
0
Fork 0
mirror of https://github.com/mukul975/Anthropic-Cybersecurity-Skills.git synced 2026-08-03 17:30:19 +03:00
Code Issues Packages Projects Releases Wiki Activity

Rewrite 548 skill descriptions to the activation rubric

Browse Source 
Each rewritten description now states both what the skill does (concrete
capability, named tools/artifacts) and an explicit when-to-use trigger,
improving agent discovery/activation. Grounded in each skill's own body;
changes confined to the `description` field only (bodies and all other
frontmatter untouched). Produced by a gated audit->rewrite->recheck loop
(548 -> 0 flagged) with a sampled anti-invention check (0 ungrounded).

Schema: 817/817 pass. Framework-ID gate: 0 defects.
This commit is contained in:
Mahipal
2026-08-02 09:32:13 -07:00
parent 04a207702e
commit 2fb6a9faff
548 changed files with 2189 additions and 1915 deletions
Download Patch File Download Diff File Expand all files Collapse all files
skills/testing-api-for-broken-object-level-authorization/SKILL.md
+6 -8
View File
@@ -1,13 +1,11 @@
---
name: testing-api-for-broken-object-level-authorization
description: 'Tests REST and GraphQL APIs for Broken Object Level Authorization (BOLA/IDOR)
vulnerabilities where an authenticated user can access or modify resources belonging
to other users by manipulating object identifiers in API requests. The tester intercepts
API calls, identifies object ID parameters (numeric IDs, UUIDs, slugs), and systematically
replaces them with IDs belonging to other users to determine if the server enforces
per-object authorization. This is OWASP API Security Top 10 2023 risk API1. Activates
for requests involving BOLA testing, IDOR in APIs, object-level authorization testing,
or API access control bypass.
description: 'Tests REST and GraphQL APIs for Broken Object Level Authorization (BOLA/IDOR,
OWASP API1:2023) by intercepting API calls, identifying object ID parameters (numeric
IDs, UUIDs, slugs), and systematically substituting IDs belonging to other users
to check whether the server enforces per-object authorization. Use when asked to
test BOLA or IDOR in an API, verify object-level authorization, or assess an API
for access control bypass.
'
domain: cybersecurity